From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01B90C00140 for ; Mon, 8 Aug 2022 15:02:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235685AbiHHPCy (ORCPT ); Mon, 8 Aug 2022 11:02:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232079AbiHHPCx (ORCPT ); Mon, 8 Aug 2022 11:02:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4794B853 for ; Mon, 8 Aug 2022 08:02:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 78BC160F67 for ; Mon, 8 Aug 2022 15:02:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B246EC433D6; Mon, 8 Aug 2022 15:02:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1659970971; bh=8Hq8azgVaoYiKKUjkRBiRvsfzsg/rKvuzl2A/lbqEWw=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=sYEeW9Rq3UBCb47cm5MjEK+d1orGcYhMFk6Tx/GHsjZIseIr2j7tmMu2hEapb+ZR9 20FX8Kz4xR7yApseCAnbRveA6Pi0B7Kro223bs2wPVrZUB/b8o8EGVEZzvk4LsAln5 t9hYGnGp+qRwdQy4/XYFybEk4zoeCmxEGlb6x+Eu+BsjbW8IEggp+c82qp1M40r98b GIhc5HFqksYDtP9rUmLr14aaDH2JFqElNbTeOGlGLj/aedujk49djEkbv93QjU0NJh bPWKkBfbVVeedUMb1fCa20yfLbFm+z9Ivr1ko+E6ufOiLfPNRuvw4FlLlRHkxiovyD mWWkyja8ribGw== Received: from sofa.misterjones.org ([185.219.108.64] helo=why.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1oL4HJ-001i90-8F; Mon, 08 Aug 2022 16:02:49 +0100 Date: Mon, 08 Aug 2022 16:02:48 +0100 Message-ID: <878rnywzfr.wl-maz@kernel.org> From: Marc Zyngier To: james.morse@arm.com Cc: , , Will Deacon , Catalin Marinas Subject: Re: FAILED: patch "[PATCH] KVM: arm64: Workaround Cortex-A510's single-step and PAC trap" failed to apply to 5.15-stable tree In-Reply-To: <164415020456246@kroah.com> References: <164415020456246@kroah.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/27.1 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: james.morse@arm.com, stable@vger.kernel.org, gregkh@linuxfoundation.org, will@kernel.org, catalin.marinas@arm.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Hi James, It seems that although this patch has made it into 5.16, it never reached 5.15. Given that 5.15 is an LTS, it'd be good to have this in. Is there any chance you could respin this for 5.15? Thanks, M. On Sun, 06 Feb 2022 12:23:24 +0000, wrote: > > > The patch below does not apply to the 5.15-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to . > > thanks, > > greg k-h > > ------------------ original commit in Linus's tree ------------------ > > From 1dd498e5e26ad71e3e9130daf72cfb6a693fee03 Mon Sep 17 00:00:00 2001 > From: James Morse > Date: Thu, 27 Jan 2022 12:20:52 +0000 > Subject: [PATCH] KVM: arm64: Workaround Cortex-A510's single-step and PAC trap > errata > > Cortex-A510's erratum #2077057 causes SPSR_EL2 to be corrupted when > single-stepping authenticated ERET instructions. A single step is > expected, but a pointer authentication trap is taken instead. The > erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow > EL1 to cause a return to EL2 with a guest controlled ELR_EL2. > > Because the conditions require an ERET into active-not-pending state, > this is only a problem for the EL2 when EL2 is stepping EL1. In this case > the previous SPSR_EL2 value is preserved in struct kvm_vcpu, and can be > restored. > > Cc: stable@vger.kernel.org # 53960faf2b73: arm64: Add Cortex-A510 CPU part definition > Cc: stable@vger.kernel.org > Signed-off-by: James Morse > [maz: fixup cpucaps ordering] > Signed-off-by: Marc Zyngier > Link: https://lore.kernel.org/r/20220127122052.1584324-5-james.morse@arm.com > > diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst > index 0ec7b7f1524b..ea281dd75517 100644 > --- a/Documentation/arm64/silicon-errata.rst > +++ b/Documentation/arm64/silicon-errata.rst > @@ -100,6 +100,8 @@ stable kernels. > +----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A510 | #2051678 | ARM64_ERRATUM_2051678 | > +----------------+-----------------+-----------------+-----------------------------+ > +| ARM | Cortex-A510 | #2077057 | ARM64_ERRATUM_2077057 | > ++----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | > +----------------+-----------------+-----------------+-----------------------------+ > | ARM | Cortex-A710 | #2054223 | ARM64_ERRATUM_2054223 | > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index f2b5a4abef21..cbcd42decb2a 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -680,6 +680,22 @@ config ARM64_ERRATUM_2051678 > > If unsure, say Y. > > +config ARM64_ERRATUM_2077057 > + bool "Cortex-A510: 2077057: workaround software-step corrupting SPSR_EL2" > + help > + This option adds the workaround for ARM Cortex-A510 erratum 2077057. > + Affected Cortex-A510 may corrupt SPSR_EL2 when the a step exception is > + expected, but a Pointer Authentication trap is taken instead. The > + erratum causes SPSR_EL1 to be copied to SPSR_EL2, which could allow > + EL1 to cause a return to EL2 with a guest controlled ELR_EL2. > + > + This can only happen when EL2 is stepping EL1. > + > + When these conditions occur, the SPSR_EL2 value is unchanged from the > + previous guest entry, and can be restored from the in-memory copy. > + > + If unsure, say Y. > + > config ARM64_ERRATUM_2119858 > bool "Cortex-A710/X2: 2119858: workaround TRBE overwriting trace data in FILL mode" > default y > diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c > index 066098198c24..b217941713a8 100644 > --- a/arch/arm64/kernel/cpu_errata.c > +++ b/arch/arm64/kernel/cpu_errata.c > @@ -600,6 +600,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = { > CAP_MIDR_RANGE_LIST(trbe_write_out_of_range_cpus), > }, > #endif > +#ifdef CONFIG_ARM64_ERRATUM_2077057 > + { > + .desc = "ARM erratum 2077057", > + .capability = ARM64_WORKAROUND_2077057, > + .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, > + ERRATA_MIDR_REV_RANGE(MIDR_CORTEX_A510, 0, 0, 2), > + }, > +#endif > #ifdef CONFIG_ARM64_ERRATUM_2064142 > { > .desc = "ARM erratum 2064142", > diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h > index 331dd10821df..701cfb964905 100644 > --- a/arch/arm64/kvm/hyp/include/hyp/switch.h > +++ b/arch/arm64/kvm/hyp/include/hyp/switch.h > @@ -402,6 +402,24 @@ static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > return false; > } > > +static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, u64 *exit_code) > +{ > + /* > + * Check for the conditions of Cortex-A510's #2077057. When these occur > + * SPSR_EL2 can't be trusted, but isn't needed either as it is > + * unchanged from the value in vcpu_gp_regs(vcpu)->pstate. > + * Are we single-stepping the guest, and took a PAC exception from the > + * active-not-pending state? > + */ > + if (cpus_have_final_cap(ARM64_WORKAROUND_2077057) && > + vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP && > + *vcpu_cpsr(vcpu) & DBG_SPSR_SS && > + ESR_ELx_EC(read_sysreg_el2(SYS_ESR)) == ESR_ELx_EC_PAC) > + write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR); > + > + vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > +} > + > /* > * Return true when we were able to fixup the guest exit and should return to > * the guest, false when we should restore the host state and return to the > @@ -413,7 +431,7 @@ static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code) > * Save PSTATE early so that we can evaluate the vcpu mode > * early on. > */ > - vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR); > + synchronize_vcpu_pstate(vcpu, exit_code); > > /* > * Check whether we want to repaint the state one way or > diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps > index e7719e8f18de..9c65b1e25a96 100644 > --- a/arch/arm64/tools/cpucaps > +++ b/arch/arm64/tools/cpucaps > @@ -55,9 +55,10 @@ WORKAROUND_1418040 > WORKAROUND_1463225 > WORKAROUND_1508412 > WORKAROUND_1542419 > -WORKAROUND_2064142 > -WORKAROUND_2038923 > WORKAROUND_1902691 > +WORKAROUND_2038923 > +WORKAROUND_2064142 > +WORKAROUND_2077057 > WORKAROUND_TRBE_OVERWRITE_FILL_MODE > WORKAROUND_TSB_FLUSH_FAILURE > WORKAROUND_TRBE_WRITE_OUT_OF_RANGE > > -- Without deviation from the norm, progress is not possible.